{"id":676021,"url":"https://alion.io/job/camlin-devsecops-engineer","title":"DevSecOps - Embedded Software Security Engineer","company":{"id":668999,"name":"Camlin","domain":"camlin.co","url":"https://alion.io/company/camlin","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Rippling","truth_index":{"grade":"A","score":85,"open_postings":17,"ghost_share":0,"stale_share":0.588,"repost_share":0,"time_to_fill_p50_days":29,"computed_at":"2026-10-31T05:58:55Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Kraków, Poland"],"countries":["PL"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":48000,"max_usd":102000,"period":"year","method":"role_country_seniority_unknown","sample_n":159},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"C++","optional":false},{"name":"CVE","optional":false},{"name":"CVSS","optional":false},{"name":"Git","optional":false},{"name":"Least Privilege","optional":false},{"name":"Linux","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"SonarQube","optional":false}],"status":"live","first_seen_at":"2026-03-16T10:40:23Z","employer_posted_date":"2026-03-16","last_verified_at":"2026-10-31T11:35:45Z","board_verified":true,"closed_at":null,"days_open":229,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":228},"description":"About Camlin\nCamlin is a global technology leader that operates with the vision of bringing revolutionary products to life for a wide range of industries, including power and rail, and also has interests in a number of R&D projects in a variety of scientific sectors.\nAt Camlin we believe in high quality engineering and design, allowing us to develop market leading products and services. In short, we love creating value for our customers by solving difficult problems. As of now, Camlin operates in over 20 countries worldwide.\nWe are looking for a Engineer Embedded Software Security Engineer to strengthen our Embedded Systems Unit.\nIn this role, you will collaborate closely with embedded development teams and our Information Security Management System (ISMS) team to build security into the product lifecycle and demonstrate compliance with the Cyber Resilience Act (CRA), the Radio Equipment Directive (RED), and IEC 62443.\nYou will apply ISMS-defined security policies in day-to-day product engineering rather than create governance processes. Your focus will be embedded software, firmware, product interfaces, secure updates, vulnerability handling, and security evidence throughout development and release.\nYou will support the secure development and release lifecycle of embedded products, including firmware, Embedded Linux platforms, device communications, and associated security tooling.\nIMPORTANT NOTE: Although this role offers hybrid and remote-friendly working, at least ONE INTERVIEW in the selection process will take place onsite in our Kraków office.\nResponsibilities\nSecure Development & Compliance\nApply ISMS-defined secure development workflows and support engineering teams with threat modelling, security requirements, secure design reviews, secure coding, access control, secure update mechanisms, and product security documentation aligned with CRA, RED, and IEC 62443.\nVulnerability Scanning & Reporting\nConfigure and run SCA, SAST, and other appropriate security analysis tools for embedded software, firmware, and build outputs.\nTriage findings, assess exploitability and product impact, support remediation, and prepare actionable vulnerability records aligned with CRA and IEC 62443 vulnerability-handling requirements.\nMonitor relevant vulnerability disclosures affecting third-party components and coordinate product impact assessments.\nSecurity Testing\nPerform or coordinate white-box and grey-box security testing of firmware, Embedded Linux systems, device interfaces, communication protocols, and update mechanisms.\nValidate security controls against product requirements, RED Article 3.3(d/e/f), and applicable IEC 62443 component requirements.\nDocument reproducible findings, work with developers on remediation, and verify fixes before release.\nSoftware License & SBOM Reporting\nGenerate, validate, and maintain Software Bills of Materials (SBOMs) for embedded product releases.\nReview third-party and open-source components for known vulnerabilities, provenance, and licence obligations, and maintain evidence required for CRA compliance and supply-chain transparency.\nProduct Trust, Secure Boot & Provisioning\nSupport secure boot, firmware signing, image verification, anti-rollback, and secure update mechanisms.\nSupport certificate provisioning, device identity, key-management tooling, and secure device onboarding in accordance with ISMS-defined controls.\nReview the secure handling of secrets and protected configuration across development, manufacturing, and field-service workflows.\nRequired Skills & Qualifications\nTechnical Skills\nExperience developing, testing, or securing embedded software in C or C++ and scripting in Python. \nExperience with Embedded Linux and Yocto, including package composition, build artefacts, and update mechanisms.\nPractical knowledge of secure boot, firmware signing, cryptographic key handling, device identity, and secure firmware updates.\nExperience with SCA and SAST tools such as SonarQube, Black Duck, or equivalent, including investigation and remediation of findings.\nUnderstanding of SBOM formats and workflows, including CycloneDX or SPDX.\nAbility to analyse embedded attack surfaces, debug security issues, and communicate actionable findings to software engineers.\nWorking knowledge of Git-based development and automated build pipelines as they relate to secure, traceable product releases.\nCybersecurity & Standards\nStrong understanding of embedded cybersecurity principles, including least privilege, defence in depth, secure defaults, trust boundaries, and attack-surface reduction.\nWorking knowledge of CRA, RED cybersecurity requirements, and IEC 62443, including secure development lifecycle and component-level security concepts.\nExperience applying secure SDLC practices such as threat modelling, security requirements, design review, vulnerability management, security testing, and release evidence.\nKnowledge of secure communication protocols and applied cryptography, including TLS, certificates, authentication, encryption, and key lifecycle considerations.\nDesired Qualifications (Nice -to -Have)\nExperience with hardware-backed security features such as TPMs, secure elements, trusted execution environments, or microcontroller security functions.\nExperience with embedded penetration testing, protocol analysis, fuzzing, or firmware reverse engineering.\nFamiliarity with CVE/CVSS, coordinated vulnerability disclosure, and product security incident response.\nExperience producing security assurance evidence for regulated or industrial products.\nRelevant product security or embedded security certification.\nBenefits:\nEmployment contract with competitive salary\nWork in small, self-organized and autonomous development teams with the ability to choose technologies and best practices\nHybrid work model (office in Kraków)\nCompany Pension & Life Assurance Schemes\nOn-site parking (car and bike)\nUoP with 80% author’s rights tax relief\nMyBenefit system with Multisport membership, private healthcare (Medicover)\nWellness programmes\nOur Values\nWe work together\nWe believe in people\nWe won’t accept the ‘way it has always been done’\nWe listen to learn\nWe’re trying to do the right thing\nEqual Employment Opportunity Statement\nIndividuals seeking employment at Camlin are considered without regards to race, colour, religion, national origin, age, sex, marital states, ancestry, physical or mental disability, gender identity or sexual orientation.","description_format":"text","description_chars":6458,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Hybrid work"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","DevSecOps","Event Management","Management Consulting"],"lifecycle":[{"event":"open","at":"2026-09-10T22:53:18Z"}],"visa":[],"liveness":{"score":3,"band":"cold","label":"Long shot","p_open":1,"p_active":0.102,"p_room":0.28,"age_days":228,"expected_fill_days":29,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-10-31T05:58:55Z"},"pay":null,"html_url":"https://alion.io/job/camlin-devsecops-engineer","json_url":"https://alion.io/job/camlin-devsecops-engineer.json","meta":{"generated_at":"2026-10-31T15:05:07Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":23496,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-01T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":668999},"rest":"https://alion.io/mcp/rest/get_company?id=668999"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcamlin-devsecops-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcamlin-devsecops-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcamlin-devsecops-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/camlin-devsecops-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcamlin-devsecops-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":676021}},{"tool":"search_jobs","arguments":{"company":"camlin.co","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":676021},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}